summaryrefslogtreecommitdiffstats
path: root/Configure
AgeCommit message (Collapse)Author
2016-03-01Disable EXPORT and LOW SSLv3+ ciphers by defaultViktor Dukhovni
Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-03-01Disable SSLv2 default build, default negotiation and weak ciphers.Viktor Dukhovni
SSLv2 is by default disabled at build-time. Builds that are not configured with "enable-ssl2" will not support SSLv2. Even if "enable-ssl2" is used, users who want to negotiate SSLv2 via the version-flexible SSLv23_method() will need to explicitly call either of: SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2); or SSL_clear_options(ssl, SSL_OP_NO_SSLv2); as appropriate. Even if either of those is used, or the application explicitly uses the version-specific SSLv2_method() or its client or server variants, SSLv2 ciphers vulnerable to exhaustive search key recovery have been removed. Specifically, the SSLv2 40-bit EXPORT ciphers, and SSLv2 56-bit DES are no longer available. Mitigation for CVE-2016-0800 Reviewed-by: Emilia Käsper <emilia@openssl.org>
2016-01-19Fix BSD -rpath parameterRichard Levitte
For BSD systems, Configure adds a shared_ldflags including a reference to the Makefile variable LIBRPATH, but since it must be passed down to Makefile.shared, care must be taken so the value of LIBRPATH doesn't get expanded too early, or it ends up giving an empty string. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit c64879d3f3cc4c7f1c436a9fe3bd109847a23629)
2015-12-16Provide better "make depend" warning.Rich Salz
Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 2e31ef0366d368ac8cf7f5ecc9052bff27337799)
2015-11-09Make the match for previous cflags a bit more strictRichard Levitte
./Configure [target] --strict-warnings -Wno-pedantic-ms-format would not add '-pedantic' because it matches '-Wno-pedantic-ms-format', which was added first. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 6703c4ea87b30554283deaa5df1f8d68725d3ee4)
2015-10-08Fix travis build for 1.0.1Rich Salz
Add explicit linux-clang targets Add --strict-warnings support for clang Disable mingw debug builds Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org>
2015-05-26Configure: replace -mv8 with -mcpu=v8 in SPARC config lines.Andy Polyakov
RT#3860 Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit aa1e42215b6729c0143fb056e3791e3fcdf7af6a)
2015-02-22Restore -DTERMIO/-DTERMIOS on Windows platforms.Richard Levitte
The previous defaulting to TERMIOS took away -DTERMIOS / -DTERMIO a bit too enthusiastically. Windows/DOSish platforms of all sorts get identified as OPENSSL_SYS_MSDOS, and they get a different treatment altogether UNLESS -DTERMIO or -DTERMIOS is explicitely given with the configuration. The answer is to restore those macro definitions for the affected configuration targets. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit ba4bdee7184a5cea5bef8739eb360e5c2bc3b52c) Conflicts: Configure
2015-02-22Assume TERMIOS is default, remove TERMIO on all Linux.Richard Levitte
The rationale for this move is that TERMIOS is default, supported by POSIX-1.2001, and most definitely on Linux. For a few other systems, TERMIO may still be the termnial interface of preference, so we keep -DTERMIO on those in Configure. crypto/ui/ui_openssl.c is simplified in this regard, and will define TERMIOS for all systems except a select few exceptions. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 64e6bf64b36136d487e2fbf907f09612e69ae911) Conflicts: Configure crypto/ui/ui_openssl.c
2015-01-27Revert "Remove engine_rsax and its asm file."Rich Salz
This reverts commit 5226c62b7632dfaf38480919d406307318a7d145. Reviewed-by: Andy Polyakov <appro@openssl.org>
2015-01-26Remove engine_rsax and its asm file.Rich Salz
cherry-picked from db7cb7ab9a5968f32ddbe11c3fba71ccbf4ffa53 This wasn't cleanly cherry-picked, since the build process changed a bit for 1.0.2. Reviewed-by: Andy Polyakov <appro@openssl.org>
2014-11-19New option no-ssl3-method which removes SSLv3_*methodDr. Stephen Henson
When no-ssl3 is set only make SSLv3 disabled by default. Retain -ssl3 options for s_client/s_server/ssltest. When no-ssl3-method is set SSLv3_*method() is removed and all -ssl3 options. We should document this somewhere, e.g. wiki, FAQ or manual page. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 3881d8106df732fc433d30446625dfa2396da42d) Conflicts: util/mkdef.pl
2014-08-27RT2308: Add extern "C" { ... } wrapperRich Salz
Add the wrapper to all public header files (Configure generates one). Don't bother for those that are just lists of #define's that do renaming. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 089f10e69ece75ce31540501fe0898b15e898552)
2014-08-01Update $default_depflags to match current defaults.Bodo Moeller
2014-07-24Add conditional unit testing interface.Dr. Stephen Henson
Don't call internal functions directly call them through SSL_test_functions(). This also makes unit testing work on Windows and platforms that don't export internal functions from shared libraries. By default unit testing is not enabled: it requires the compile time option "enable-unit-test". Reviewed-by: Geoff Thorpe <geoff@openssl.org> (cherry picked from commit e0fc7961c4fbd27577fb519d9aea2dc788742715) Conflicts: ssl/Makefile util/mkdef.pl
2014-03-07Remove -WX option from debug-VC-WIN32Dr. Stephen Henson
2013-09-16 Fix overly lenient comparisons:Bodo Moeller
- EC_GROUP_cmp shouldn't consider curves equal just because the curve name is the same. (They really *should* be the same in this case, but there's an EC_GROUP_set_curve_name API, which could be misused.) - EC_POINT_cmp shouldn't return 0 for ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED or EC_R_INCOMPATIBLE_OBJECTS errors because in a cmp API, 0 indicates equality (not an error). Reported by: king cope (cherry picked from commit 312a46791ab465cfa3bf26764361faed0e5df014)
2013-02-07Add clang target.Ben Laurie
2013-01-07Update debug-steve64Dr. Stephen Henson
2012-12-13Add 64 bit target.Ben Laurie
2012-10-16aix[64]-cc: get MT support right [from HEAD].Andy Polyakov
PR: 2896
2012-09-24* Configure: make the debug-levitte-linux{elf,noasm} less extreme.Richard Levitte
2012-08-13./Configure: libcrypto.a can grow to many GB on Solaris 10, because of ar bugAndy Polyakov
[from HEAD]. PR: 2838
2012-03-14remove trailing slashDr. Stephen Henson
2012-03-03Configure: make no-whirlpool work [from HEAD].Andy Polyakov
2012-02-26Configure: remove adding of -D_XPG4_2 -D__EXTENSIONS__ in sctp builds,Andy Polyakov
see corresponding commit to HEAD for details.
2012-02-02hpux-parisc2-*: engage assembler [from HEAD] and make it link.Andy Polyakov
2012-01-05disable heartbeats if tlsext disabledDr. Stephen Henson
2011-12-27update default depflagsDr. Stephen Henson
2011-12-25PR: 2535Dr. Stephen Henson
Submitted by: Robin Seggelmann <seggelmann@fh-muenster.de> Reviewed by: steve Add SCTP support for DTLS (RFC 6083).
2011-12-19PR: 2563Dr. Stephen Henson
Submitted by: Paul Green <Paul.Green@stratus.com> Reviewed by: steve Improved PRNG seeding for VOS.
2011-12-02Fix warnings.Ben Laurie
2011-11-24Indent.Ben Laurie
2011-11-15Configure, e_aes.c: allow for XTS assembler implementation [from HEAD].Andy Polyakov
2011-11-14Configure, etc.: engage additional assembler modules.Andy Polyakov
2011-11-13make depend.Ben Laurie
2011-10-19Fix indentationBodo Möller
2011-10-19Fix warnings.Bodo Möller
Also, use the common Configure mechanism for enabling/disabling the 64-bit ECC code.
2011-10-13For now disable RSAX ENGINE for FIPS builds: it sets a non-FIPS RSADr. Stephen Henson
method which stops FIPS mode working.
2011-09-05Fix expected DEFFLAG for default config.Bodo Möller
2011-08-23Add RC4-MD5 and AESNI-SHA1 "stitched" implementations [from HEAD].Andy Polyakov
2011-08-14eng_rsax.c: make it work on Win64.Andy Polyakov
2011-07-20Add RSAX builtin engine [from HEAD].Andy Polyakov
2011-07-01No need for trailing slash any more.Dr. Stephen Henson
2011-06-28Configure: add aesni-x86_64.o to VC-WIN64A line.Andy Polyakov
2011-06-28AES-NI backport from HEAD. Note that e_aes.c doesn't implement all modesAndy Polyakov
from HEAD yet, more will be back-ported later.
2011-06-18Don't add trailing slash to FIPSDIR: it causes problems with Windows builds.Dr. Stephen Henson
2011-06-09Add android platforms. Let fipsdir come from environment.Dr. Stephen Henson
2011-05-26The first of many changes to make OpenSSL 1.0.1 FIPS capable.Dr. Stephen Henson
Add static build support to openssl utility. Add new "fips" option to Configure. Make use of installed fipsld and fips_standalone_sha1 Initialise FIPS error callbacks, locking and DRBG. Doesn't do anything much yet: no crypto is redirected to the FIPS module. Doesn't completely build either but the openssl utility can enter FIPS mode: which doesn't do anything much either.
2011-05-12Ooops fix typo.Dr. Stephen Henson
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-12 19:41:56 +0000